Vulnerabilidades en sooperset
34 resultadosCVE-2026-27825CRITICALMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentEPSS 1.5%CVE-2026-27826HIGHMCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headersEPSS 1.0%CVE-2026-77254CRITICALMCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentialsEPSS 0.6%CVE-2026-77271HIGHMCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)EPSS 0.5%CVE-2026-77262HIGHMCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)EPSS 0.5%CVE-2026-73496HIGHMCP Atlassian: Arbitrary server-side file read via attachment uploadEPSS 0.5%CVE-2026-73498HIGHMCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachmentEPSS 0.5%CVE-2026-77266MEDIUMMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool callEPSS 0.4%CVE-2026-77246HIGHMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathEPSS 0.4%CVE-2026-77248HIGHMCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transportEPSS 0.4%CVE-2026-77259HIGHMCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsEPSS 0.4%CVE-2026-77255HIGHMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueEPSS 0.4%CVE-2026-77269MEDIUMMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)EPSS 0.4%CVE-2026-77247HIGHMCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parametersEPSS 0.4%CVE-2026-77257HIGHMCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsEPSS 0.4%CVE-2026-73497MEDIUMMCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadataEPSS 0.4%CVE-2026-77270MEDIUMMCP Atlassian: Arbitrary File Read via Upload Attachment ToolsEPSS 0.4%CVE-2026-77253HIGHMCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filesEPSS 0.4%CVE-2026-77260HIGHMCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)EPSS 0.3%CVE-2026-77256HIGHMCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umaskEPSS 0.3%